There is a Javascript flaw in the way that Apple Safari on iOS handles some URLs, allowing a hacker to produce a spoofed web site that’s an exact copy of the real one with a proper address.